What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Wierd things are happening

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi

Theres a few weird things going on with my computer at the moment. Im getting browser re-directs to advert pages, pop-up's & strangest of all, when trying to log in to YouTube I get the following message: "I Call Shenanigans" and get chucked out. Ive reported this to YouTube but they're pretty useless. It's been suggested the problem coulb be a scipt or Malware on my computer, but I don't know, so could someone please take a look at my log. Thanks.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:03:47, on 30/08/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Windows\PLFSetI.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Users\Dan\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\Windows\TEMP\E_S40BC.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{750EE0BE-F080-47C9-9D63-768AD75FA706}: NameServer = 212.139.132.11 212.139.132.10
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit (mi-raysat_3dsMax2009_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe

–
End of file - 8946 bytes

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
 Monday, August 31, 2009
 Operating system: Microsoft Windows Vista Home Basic Edition, 32-bit Service Pack 2 (build 6002)
 Kaspersky Online Scanner version: 7.0.26.13
 Last database update: Sunday, August 30, 2009 20:45:56
 Records in database: 2730133
——————————————————————————–

Scan settings:
	scan using the following database: extended
	Scan archives: yes
	Scan e-mail databases: yes

Scan area - My Computer:
	C:\
	D:\
	E:\

Scan statistics:
	Objects scanned: 98433
	Threats found: 0
	Infected objects found: 0
	Suspicious objects found: 0
	Scan duration: 03:32:24

No threats found. Scanned area is clean.

Selected area has been scanned.
Post #2
[external image: Posted Image]

Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to help you with your malware issues. I'd be grateful if you would note the following:

  • Absence of symptoms does not always mean the computer is clean
  • Please do not run any scans or fixes without my direction.
  • Finally, stay with this topic until I give you the final 'All clear' post.

Please follow the instructions in our Welcome New Members topic, and post those logs here. We'll continue from there.
Post #3
Hi Raktor

Here is my log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:19:10, on 01/09/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Windows\PLFSetI.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Users\Dan\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe"
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\Windows\TEMP\E_S40BC.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit (mi-raysat_3dsMax2009_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe

–
End of file - 8778 bytes
Post #4
manicd,

We have a new procedure for logs now - we use DDS and RootRepeal instead of HijackThis. If you go to the new Welcome New Members topic, there will be instructions on how to download and run these tools, and what logs you need to give me. :)
Post #5
Hi Raktor

Sorry for being ignorant I didn't think the "Welcome New Members" applied to me lol.
Ok the scan I did with RootRepeal which was fine and the results are posted below but when I downloaded the DDS file it has assigned its self to the program AutoCAD, I think because it's a script file.
[external image: Posted Image]

I don't know how to run it as a separate win application.

RootRepeal:


ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:		2009/09/02 18:41
Program Version:		Version 1.3.5.0
Windows Version:		Windows Vista SP2
==================================================

Drivers
——————-
Name: dump_iaStor.sys
Image Path: C:\Windows\System32\Drivers\dump_iaStor.sys
Address: 0x8F51D000	Size: 888832	File Visible: No	Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0xAFDBA000	Size: 49152	File Visible: No	Signed: -
Status: -

Processes
——————-
Path: System
PID: 4	Status: Locked to the Windows API!

Path: C:\Windows\System32\audiodg.exe
PID: 1396	Status: Locked to the Windows API!

==EOF==
Post #7 last edited
Hi Raktor

I can't seem to upload the "Zipped Attach Scan" nor can I upload it as as a txt file.
Error Upload failed. The file was larger than the available space

DDS (Ver_09-07-30.01) - NTFSx86  
Run by [removed] at 20:29:53.22 on 03/09/2009
Internet Explorer: 8.0.6001.18813 BrowserJavaVersion: 1.6.0_15
Microsoft® Windows Vista™ Home Basic   6.0.6002.2.1252.44.1033.18.3000.1780 [GMT 1:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Thomson\ST330\service\st330service.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Windows\PLFSetI.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Dan\Desktop\dds.pif
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
BHO: ShowBarObj Class: {83a2f9b1-01a2-4aa5-87d1-45b6b8505e96} - c:\program files\acer\empowering technology\edatasecurity\x86\ActiveToolBand.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\program files\acer\empowering technology\edatasecurity\x86\eDStoolbar.dll
uRun: [EPSON Stylus DX4000 Series] c:\windows\system32\spool\drivers\w32x86\3\e_fatibee.exe /fu "c:\windows\temp\E_S40BC.tmp" /EF "HKCU"
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [ePower_DMC] c:\program files\acer\empowering technology\epower\ePower_DMC.exe
mRun: [eDataSecurity Loader] c:\program files\acer\empowering technology\edatasecurity\x86\eDSloader.exe
mRun: [eAudio] "c:\program files\acer\empowering technology\eaudio\eAudio.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [ProductReg] "c:\program files\acer\wr_popup\ProductReg.exe"
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [LManager] c:\progra~1\launch~1\QtZgAcer.EXE
mRun: [PLFSetI] c:\windows\PLFSetI.exe
mRun: [eRecoveryService] 
mRun: [ArcadeDeluxeAgent] "c:\program files\acer arcade deluxe\acer arcade deluxe\ArcadeDeluxeAgent.exe"
mRun: [CLMLServer] "c:\program files\acer arcade deluxe\acer arcade deluxe\kernel\clml\CLMLSvc.exe"
mRun: [PlayMovie] "c:\program files\acer arcade deluxe\playmovie\PMVService.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimagehome\TrueImageMonitor.exe
mRun: [AcronisTimounterMonitor] c:\program files\acronis\trueimagehome\TimounterMonitor.exe
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {750EE0BE-F080-47C9-9D63-768AD75FA706} = 212.139.132.11 212.139.132.10
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\dan\appdata\roaming\mozilla\firefox\profiles\vxrriqxx.default\
FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota",	  5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history",	 true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata",	true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords",   false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads",   true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies",	 true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache",	   true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions",	true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history",				 true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata",				true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords",			   false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads",			   true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies",				 true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache",				   true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions",				true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps",			 false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings",			false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs",	false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 snapman380;Acronis Snapshots Manager (Build 380);c:\windows\system32\drivers\snman380.sys [2009-8-13 134272]
R0 tdrpman174;Acronis Try&Decide and Restore Points filter (build 174);c:\windows\system32\drivers\tdrpm174.sys [2009-8-13 971552]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-2-6 106208]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\acer arcade deluxe\playmovie\000.fcl [2009-8-12 61424]
R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\newtech infosystems\nti backup now 5\client\Agentsvc.exe [2008-3-3 16384]
R2 CLHNService;CLHNService;c:\program files\acer arcade deluxe\homemedia\kernel\dmp\CLHNService.exe [2009-8-12 81504]
R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2009-2-6 727720]
R2 epfwwfp;epfwwfp;c:\windows\system32\drivers\epfwwfp.sys [2009-2-6 38240]
R2 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\ETService.exe [2008-4-17 24576]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-8-12 232720]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-4-7 50424]
R2 NTIPPKernel;NTIPPKernel;c:\program files\acer arcade deluxe\homemedia\kernel\dmp\NTIPPKernel.sys [2009-8-12 122368]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-4-4 131072]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2008-3-28 210432]
R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2008-4-17 81296]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-8-12 19096]
R3 NETw5v32;Intel(R) Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2008-4-17 3658752]
R3 ST330;ST330;c:\windows\system32\drivers\st330.sys [2009-8-12 30464]
R3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [2009-8-12 12672]
R3 stppp;Speedtouch PPP Adapter Adapter;c:\windows\system32\drivers\stppp.sys [2009-8-12 49408]
R3 winbondcir;Winbond IR Transceiver;c:\windows\system32\drivers\winbondcir.sys [2007-3-28 43008]
S2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\autodesk\3ds max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [2009-3-18 86016]
S3 A310;AVerMedia A310 DVB-T;c:\windows\system32\drivers\AVerA310USB.sys [2008-4-17 25856]
S3 BDASwCap;AVerMedia A310 BDA DVBT Capture Device;c:\windows\system32\drivers\AVerA310Cap.sys [2008-4-17 42880]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-9-3 112128]
S4 Partner Service;Partner Service;"c:\programdata\partner\partner.exe" –> c:\programdata\partner\partner.exe [?]

=============== Created Last 30 ================

2009-09-02 00:21		–d—–	c:\programdata\Office Genuine Advantage
2009-09-02 00:20		–d—–	c:\users\dan\Office Genuine Advantage
2009-09-02 00:18	28,672	a——-	c:\windows\system32\Apphlpdm.dll
2009-09-02 00:18	4,240,384	a——-	c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-31 22:15		–d—–	c:\program files\common files\ChaosGroup
2009-08-31 22:15		–d—–	c:\program files\Chaos Group
2009-08-31 15:19		–d—–	c:\program files\BitComet
2009-08-28 12:50		–d—–	C:\VundoFix Backups
2009-08-26 22:35	2,048	a——-	c:\windows\system32\tzres.dll
2009-08-21 14:18	49,152	a——-	c:\windows\system32\E_DCINST.DLL
2009-08-21 14:18	71,168	a——-	c:\windows\system32\E_FLBBEE.DLL
2009-08-21 14:18	62,976	a——-	c:\windows\system32\E_FD4BBEE.DLL
2009-08-21 14:09		–d—–	c:\program files\epson
2009-08-21 14:09	46,080	a——-	c:\windows\system32\escimgd.dll
2009-08-21 14:09	29,696	a——-	c:\windows\system32\escwiad.dll
2009-08-21 14:09	22,016	a——-	c:\windows\system32\esccmd.dll
2009-08-17 23:55		–d—–	c:\users\dan\dwhelper
2009-08-15 22:57	107,368	a——-	c:\windows\system32\GEARAspi.dll
2009-08-15 22:57	23,400	a——-	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-15 22:56		–d—–	c:\program files\iPod
2009-08-15 22:56		–d—–	c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-15 22:56		–d—–	c:\program files\iTunes
2009-08-15 22:56		–d—–	c:\progra~2\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-15 22:56		–d—–	c:\program files\Bonjour
2009-08-15 22:55		–d—–	c:\programdata\Apple Computer
2009-08-15 22:54		–d—–	c:\programdata\Apple
2009-08-15 21:31		–d—–	c:\users\dan\appdata\roaming\Foxit
2009-08-15 21:31		–d—–	c:\program files\Foxit Software
2009-08-15 15:36		–d—–	c:\program files\Autodesk
2009-08-15 15:36	3,497,832	a——-	c:\windows\system32\d3dx9_34.dll
2009-08-15 15:36	1,124,720	a——-	c:\windows\system32\D3DCompiler_34.dll
2009-08-15 15:36	443,752	a——-	c:\windows\system32\d3dx10_34.dll
2009-08-15 15:36	3,426,072	a——-	c:\windows\system32\d3dx9_32.dll
2009-08-15 15:36	440,080	a——-	c:\windows\system32\d3dx10.dll
2009-08-15 15:36	2,414,360	a——-	c:\windows\system32\d3dx9_31.dll
2009-08-15 11:57		–d—–	c:\users\dan\appdata\roaming\Autodesk
2009-08-15 11:57		–d—–	c:\programdata\Autodesk
2009-08-15 11:57		–d—–	c:\program files\common files\Autodesk Shared
2009-08-15 11:57		–d—–	c:\program files\AutoCAD 2009
2009-08-15 11:56	3,727,720	a——-	c:\windows\system32\d3dx9_35.dll
2009-08-15 11:45		–d—–	C:\install
2009-08-14 22:29		–d—–	c:\program files\VideoLAN
2009-08-14 20:24	411,368	a——-	c:\windows\system32\deploytk.dll
2009-08-14 19:50		–d—–	c:\windows\system32\eu-ES
2009-08-14 19:50		–d—–	c:\windows\system32\ca-ES
2009-08-14 19:50		–d—–	c:\windows\system32\vi-VN
2009-08-14 19:40		–d—–	c:\windows\system32\EventProviders
2009-08-14 19:16	2,868,224	a——-	c:\windows\system32\mf.dll
2009-08-14 19:15	738,816	a——-	c:\windows\system32\inetcomm.dll
2009-08-14 19:14	218,624	a——-	c:\windows\system32\wdscore.dll
2009-08-14 19:14	130,560	a——-	c:\windows\system32\PkgMgr.exe
2009-08-14 19:14	247,808	a——-	c:\windows\system32\drvstore.dll
2009-08-14 18:56	0	a—h—	c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-08-13 21:37		–d—–	c:\users\dan\Option
2009-08-13 21:31	971,552	a——-	c:\windows\system32\drivers\tdrpm174.sys
2009-08-13 21:31	44,704	a——-	c:\windows\system32\drivers\tifsfilt.sys
2009-08-13 21:31		–d—–	c:\programdata\Acronis
2009-08-13 21:31	540,000	a——-	c:\windows\system32\drivers\timntr.sys
2009-08-13 21:31	134,272	a——-	c:\windows\system32\drivers\snman380.sys
2009-08-13 21:25		–d—–	c:\users\dan\appdata\roaming\ESET
2009-08-13 21:24		–d—–	c:\programdata\ESET
2009-08-13 21:24		–d—–	c:\program files\ESET
2009-08-13 21:05	72,704	a——-	c:\windows\system32\admparse.dll
2009-08-13 19:15	0	a——-	c:\windows\PhotoNow.INI
2009-08-13 18:02		–d—–	c:\program files\VS Revo Group
2009-08-13 04:31	920,088	a——-	c:\windows\system32\igxpun.exe
2009-08-13 04:31	319,456	a——-	c:\windows\system32\difxapi.dll
2009-08-13 04:31		–d—–	c:\windows\system32\Lang
2009-08-12 22:30	41,984	a——-	c:\windows\system32\netfxperf.dll
2009-08-12 22:29		–d—–	c:\program files\MSXML 4.0
2009-08-12 22:27	313,344	a——-	c:\windows\system32\wmpdxm.dll
2009-08-12 22:27	7,680	a——-	c:\windows\system32\spwmp.dll
2009-08-12 22:27	8,147,456	a——-	c:\windows\system32\wmploc.DLL
2009-08-12 22:27	4,096	a——-	c:\windows\system32\msdxm.ocx
2009-08-12 22:27	4,096	a——-	c:\windows\system32\dxmasf.dll
2009-08-12 22:27	43,520	a——-	c:\windows\system32\msdxm.tlb
2009-08-12 22:27	18,432	a——-	c:\windows\system32\amcompat.tlb
2009-08-12 22:26	289,792	a——-	c:\windows\system32\atmfd.dll
2009-08-12 22:26	156,672	a——-	c:\windows\system32\t2embed.dll
2009-08-12 22:26	72,704	a——-	c:\windows\system32\fontsub.dll
2009-08-12 22:26	34,304	a——-	c:\windows\system32\atmlib.dll
2009-08-12 22:26	23,552	a——-	c:\windows\system32\lpk.dll
2009-08-12 22:26	10,240	a——-	c:\windows\system32\dciman32.dll
2009-08-12 22:26	160,256	a——-	c:\windows\system32\wkssvc.dll
2009-08-12 22:26	71,680	a——-	c:\windows\system32\atl.dll
2009-08-12 22:24	2,034,688	a——-	c:\windows\system32\win32k.sys
2009-08-12 22:23	91,136	a——-	c:\windows\system32\avifil32.dll
2009-08-12 22:14	1,524,736	a——-	c:\windows\system32\wucltux.dll
2009-08-12 22:14	83,456	a——-	c:\windows\system32\wudriver.dll
2009-08-12 22:14	162,064	a——-	c:\windows\system32\wuwebv.dll
2009-08-12 22:14	31,232	a——-	c:\windows\system32\wuapp.exe
2009-08-12 22:11	49,408	a——-	c:\windows\system32\drivers\stppp.sys
2009-08-12 22:11	30,464	a——-	c:\windows\system32\drivers\st330.sys
2009-08-12 22:11	12,672	a——-	c:\windows\system32\drivers\stbus.sys
2009-08-12 22:11	16,128	a——-	c:\windows\system32\drivers\lpwdm.sys
2009-08-12 22:11		–d—–	c:\program files\Thomson
2009-08-12 22:10		–d—–	c:\temp\Thomson
2009-08-12 22:10		–d—–	C:\Temp
2009-08-12 22:02		–d—–	c:\users\dan\appdata\roaming\Malwarebytes
2009-08-12 22:02	19,096	a——-	c:\windows\system32\drivers\mbam.sys
2009-08-12 22:02	38,160	a——-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-12 22:02		–d—–	c:\programdata\Malwarebytes
2009-08-12 22:02		–d—–	c:\program files\Malwarebytes' Anti-Malware
2009-08-12 22:02		–d—–	c:\progra~2\Malwarebytes
2009-08-12 21:45	1,145	a——-	c:\windows\HOTFIX.TAG
2009-08-12 21:39	6,656	a——-	c:\windows\system32\kbd106n.dll
2009-08-12 21:32	44,544	a——-	c:\windows\system32\msxml4a.dll
2009-08-12 21:30		–d—–	c:\programdata\CyberLink
2009-08-12 21:28		–d—–	c:\program files\Acer Arcade Deluxe
2009-08-12 21:24	0	a——-	c:\windows\system32\LogConfigTemp.xml
2009-08-12 21:23	92	a——-	c:\windows\GridV.UNI
2009-08-12 21:23		–d—–	c:\program files\Acer Inc
2009-08-12 21:22	626,688	a——-	c:\windows\Image.dll
2009-08-12 21:22	262,144	a——-	c:\windows\Acer Crystal Eye webcam.EXE
2009-08-12 21:22	222,382	a——-	c:\windows\Acer Crystal Eye webcam.ico
2009-08-12 21:22	200,704	a——-	c:\windows\PLFSetI.exe
2009-08-12 21:22	4,838	a——-	c:\windows\Suyin.reg
2009-08-12 21:22	36	a——-	c:\windows\PidList.ini
2009-08-12 21:21	83	a——-	c:\windows\QtZgAcer.UNI
2009-08-12 21:21		–d—–	c:\program files\Launch Manager
2009-08-12 21:18	324,120	a——-	c:\windows\system32\drivers\iaStor.sys
2009-08-12 21:06	18,904	a——-	c:\windows\system32\StructuredQuerySchemaTrivial.bin
2009-08-12 21:05	11,967,524	a——-	c:\windows\system32\korwbrkr.lex
2009-08-12 20:57	153	a——-	c:\windows\system32\RacUREx.xml
2009-08-12 20:51		–dsh—	C:\$RECYCLE.BIN
2009-08-12 20:48		–d—–	c:\programdata\Google
2009-08-12 20:48	16,080	a——-	c:\windows\system32\results.xml
2009-08-12 20:47		–d—–	c:\users\Dan

==================== Find3M  ====================

2009-08-29 03:30	173,056	a——-	c:\windows\apppatch\AcXtrnal.dll
2009-08-29 03:30	458,752	a——-	c:\windows\apppatch\AcSpecfc.dll
2009-08-29 03:30	2,159,616	a——-	c:\windows\apppatch\AcGenral.dll
2009-08-29 03:30	542,720	a——-	c:\windows\apppatch\AcLayers.dll
2009-08-21 14:19	143,360	a——-	c:\windows\inf\infstrng.dat
2009-08-21 14:19	51,200	a——-	c:\windows\inf\infpub.dat
2009-08-21 14:19	86,016	a——-	c:\windows\inf\infstor.dat
2009-08-14 19:50	665,600	a——-	c:\windows\inf\drvindex.dat
2009-08-03 15:07	403,816	a——-	c:\windows\system32\OGACheckControl.dll
2009-08-03 15:07	322,928	a——-	c:\windows\system32\OGAAddin.dll
2009-08-03 15:07	230,768	a——-	c:\windows\system32\OGAEXEC.exe
2009-07-21 22:52	915,456	a——-	c:\windows\system32\wininet.dll
2009-07-21 22:47	109,056	a——-	c:\windows\system32\iesysprep.dll
2009-07-21 22:47	71,680	a——-	c:\windows\system32\iesetup.dll
2009-07-21 21:13	133,632	a——-	c:\windows\system32\ieUnatt.exe
2009-07-09 12:16	2,060,288	a——-	c:\windows\system32\usbaaplrc.dll
2009-07-09 12:16	39,424	a——-	c:\windows\system32\drivers\usbaapl.sys
2009-06-15 15:54	175,104	a——-	c:\windows\system32\wdigest.dll
2009-06-15 15:53	72,704	a——-	c:\windows\system32\secur32.dll
2009-06-15 15:53	270,848	a——-	c:\windows\system32\schannel.dll
2009-06-15 15:53	218,624	a——-	c:\windows\system32\msv1_0.dll
2009-06-15 15:52	1,259,008	a——-	c:\windows\system32\lsasrv.dll
2009-06-15 15:52	499,712	a——-	c:\windows\system32\kerberos.dll
2009-06-15 13:48	9,728	a——-	c:\windows\system32\lsass.exe
2008-01-21 03:57	174	a–sh—	c:\program files\desktop.ini
2006-11-02 13:39	287,440	a——-	c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 13:39	287,440	a——-	c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 13:39	30,674	a——-	c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 13:39	30,674	a——-	c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 10:20	287,440	a——-	c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20	287,440	a——-	c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20	30,674	a——-	c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20	30,674	a——-	c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 20:31:15.96 ===============
Post #8
1) MBAM
You already have Malwarebytes' Anti-Malware installed. Please open it, and update it via the updates tab to the latest version and definitions.
  • Once the program has updated, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

2) ESET
You can use either Internet Explorer or Mozilla FireFox for this scan.
As you are running Windows Vista, please open your browser by right clicking on it and selecting Run As Administrator, for this scan only.

  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

3) What You Will Need To Post:
  • MBAM log
  • ESET log
Post #9
I did the ESET online scan and it came back clean but I still can't upload the results, so I've posted all the logs & scans you asked me to do.

Malwarebytes' Anti-Malware 1.40
Database version: 2719
Windows 6.0.6002 Service Pack 2

30/08/2009 19:59:56
mbam-log-2009-08-30 (19-59-56).txt

Scan type: Quick Scan
Objects scanned: 82086
Time elapsed: 7 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft® Windows Vista™ Home Basic 
Boot Device: \Device\HarddiskVolume2
Install Date: 13/08/2009 04:34:32
System Uptime: 09/03/2009 20:22:51 (4272 hours ago)

Motherboard: Acer, Inc. |  | Mammoth		  
Processor: Intel(R) Core(TM)2 Duo CPU	 T5800  @ 2.00GHz | U2E1 | 800/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 70 GiB total, 32.879 GiB free.
D: is FIXED (NTFS) - 70 GiB total, 69.434 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft ISATAP Adapter
Device ID: ROOT\*ISATAP\0025
Manufacturer: Microsoft
Name: isatap.{750EE0BE-F080-47C9-9D63-768AD75FA706}
PNP Device ID: ROOT\*ISATAP\0025
Service: tunnel

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft ISATAP Adapter
Device ID: ROOT\*ISATAP\0028
Manufacturer: Microsoft
Name: isatap.{750EE0BE-F080-47C9-9D63-768AD75FA706}
PNP Device ID: ROOT\*ISATAP\0028
Service: tunnel

==== System Restore Points ===================

RP189: 28/08/2009 18:05:03 - Scheduled Checkpoint
RP190: 30/08/2009 10:26:44 - Scheduled Checkpoint
RP191: 31/08/2009 01:47:10 - Pre Object Dock Installation
RP192: 31/08/2009 02:14:12 - Restore Operation
RP193: 31/08/2009 15:18:43 - Pre - Install of BitComet
RP194: 31/08/2009 17:00:53 - Restore Operation
RP195: 31/08/2009 22:08:12 - Pre-Installation of VRAY
RP196: 01/09/2009 10:43:03 - Windows Update
RP197: 02/09/2009 00:18:46 - Windows Update
RP198: 03/09/2009 12:56:13 - Scheduled Checkpoint

==== Installed Programs ======================

Acer Arcade Deluxe
Acer Crystal Eye Webcam 2.0.8
Acer eAudio Management
Acer eDataSecurity Management
Acer Empowering Technology
Acer ePower Management
Acer eRecovery Management
Acer eSettings Management
Acer GridVista
Acer Mobility Center Plug-In
Acronis True Image Home
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Agere Systems HDA Modem
Apple Mobile Device Support
Apple Software Update
AutoCAD 2009 - English
AutoCAD 2009 - English Version 4
Autodesk 3ds Max 2009 32-bit
Autodesk Backburner 2008.1
AVerMedia A310 (MiniCard, DVB-T) [removed]
Bonjour
Broadcom Gigabit Integrated Controller
EPSON Printer Software
EPSON Scan
ERUNT 1.1j
ESET Smart Security
FBX Plugin 2009.0 for Max 2009
Foxit Reader
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
iTunes
Java(TM) 6 Update 15
JMicron JMB38X Flash Media Controller
Launch Manager
LightScribe  1.4.142.1
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Mozilla Firefox (3.5.2)
MSXML 4.0 SP2 (KB954430)
NTI Backup Now 5
NTI Backup Now Standard
NTI Media Maker 8
OGA Notifier 2.0.0048.0
QuickTime
Realtek High Definition Audio Driver
Revo Uninstaller 1.83
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB969604)
SpeedTouch 330
Synaptics Pointing Device Driver
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
V-Ray for 3dsmax 2009 for x86
VBA (2627.01)
VLC media player 1.0.1
Winbond CIR Device Drivers
WinRAR archiver

==== Event Viewer Messages From Past Week ========

03/09/2009 20:24:42, Error: Server [2505]  - The server could not bind to the transport \Device\NetBT_Tcpip_{750EE0BE-F080-47C9-9D63-768AD75FA706} because another computer on the network has the same name.  The server could not start.

==== End Of File ===========================


DDS (Ver_09-07-30.01) - NTFSx86  
Run by [removed] at 20:29:53.22 on 03/09/2009
Internet Explorer: 8.0.6001.18813 BrowserJavaVersion: 1.6.0_15
Microsoft® Windows Vista™ Home Basic   6.0.6002.2.1252.44.1033.18.3000.1780 [GMT 1:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Thomson\ST330\service\st330service.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Windows\PLFSetI.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Dan\Desktop\dds.pif
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vb32&d=0809&m=aspire_7730
BHO: ShowBarObj Class: {83a2f9b1-01a2-4aa5-87d1-45b6b8505e96} - c:\program files\acer\empowering technology\edatasecurity\x86\ActiveToolBand.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\program files\acer\empowering technology\edatasecurity\x86\eDStoolbar.dll
uRun: [EPSON Stylus DX4000 Series] c:\windows\system32\spool\drivers\w32x86\3\e_fatibee.exe /fu "c:\windows\temp\E_S40BC.tmp" /EF "HKCU"
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [ePower_DMC] c:\program files\acer\empowering technology\epower\ePower_DMC.exe
mRun: [eDataSecurity Loader] c:\program files\acer\empowering technology\edatasecurity\x86\eDSloader.exe
mRun: [eAudio] "c:\program files\acer\empowering technology\eaudio\eAudio.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [ProductReg] "c:\program files\acer\wr_popup\ProductReg.exe"
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [LManager] c:\progra~1\launch~1\QtZgAcer.EXE
mRun: [PLFSetI] c:\windows\PLFSetI.exe
mRun: [eRecoveryService] 
mRun: [ArcadeDeluxeAgent] "c:\program files\acer arcade deluxe\acer arcade deluxe\ArcadeDeluxeAgent.exe"
mRun: [CLMLServer] "c:\program files\acer arcade deluxe\acer arcade deluxe\kernel\clml\CLMLSvc.exe"
mRun: [PlayMovie] "c:\program files\acer arcade deluxe\playmovie\PMVService.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimagehome\TrueImageMonitor.exe
mRun: [AcronisTimounterMonitor] c:\program files\acronis\trueimagehome\TimounterMonitor.exe
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {750EE0BE-F080-47C9-9D63-768AD75FA706} = 212.139.132.11 212.139.132.10
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\dan\appdata\roaming\mozilla\firefox\profiles\vxrriqxx.default\
FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota",	  5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history",	 true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata",	true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords",   false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads",   true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies",	 true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache",	   true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions",	true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history",				 true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata",				true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords",			   false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads",			   true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies",				 true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache",				   true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions",				true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps",			 false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings",			false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs",	false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 snapman380;Acronis Snapshots Manager (Build 380);c:\windows\system32\drivers\snman380.sys [2009-8-13 134272]
R0 tdrpman174;Acronis Try&Decide and Restore Points filter (build 174);c:\windows\system32\drivers\tdrpm174.sys [2009-8-13 971552]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-2-6 106208]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\acer arcade deluxe\playmovie\000.fcl [2009-8-12 61424]
R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\newtech infosystems\nti backup now 5\client\Agentsvc.exe [2008-3-3 16384]
R2 CLHNService;CLHNService;c:\program files\acer arcade deluxe\homemedia\kernel\dmp\CLHNService.exe [2009-8-12 81504]
R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2009-2-6 727720]
R2 epfwwfp;epfwwfp;c:\windows\system32\drivers\epfwwfp.sys [2009-2-6 38240]
R2 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\ETService.exe [2008-4-17 24576]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-8-12 232720]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-4-7 50424]
R2 NTIPPKernel;NTIPPKernel;c:\program files\acer arcade deluxe\homemedia\kernel\dmp\NTIPPKernel.sys [2009-8-12 122368]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-4-4 131072]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2008-3-28 210432]
R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2008-4-17 81296]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-8-12 19096]
R3 NETw5v32;Intel(R) Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2008-4-17 3658752]
R3 ST330;ST330;c:\windows\system32\drivers\st330.sys [2009-8-12 30464]
R3 STBUS;STBUS;c:\windows\system32\drivers\stbus.sys [2009-8-12 12672]
R3 stppp;Speedtouch PPP Adapter Adapter;c:\windows\system32\drivers\stppp.sys [2009-8-12 49408]
R3 winbondcir;Winbond IR Transceiver;c:\windows\system32\drivers\winbondcir.sys [2007-3-28 43008]
S2 mi-raysat_3dsMax2009_32;mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit;c:\program files\autodesk\3ds max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe [2009-3-18 86016]
S3 A310;AVerMedia A310 DVB-T;c:\windows\system32\drivers\AVerA310USB.sys [2008-4-17 25856]
S3 BDASwCap;AVerMedia A310 BDA DVBT Capture Device;c:\windows\system32\drivers\AVerA310Cap.sys [2008-4-17 42880]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-9-3 112128]
S4 Partner Service;Partner Service;"c:\programdata\partner\partner.exe" –> c:\programdata\partner\partner.exe [?]

=============== Created Last 30 ================

2009-09-02 00:21		–d—–	c:\programdata\Office Genuine Advantage
2009-09-02 00:20		–d—–	c:\users\dan\Office Genuine Advantage
2009-09-02 00:18	28,672	a——-	c:\windows\system32\Apphlpdm.dll
2009-09-02 00:18	4,240,384	a——-	c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-31 22:15		–d—–	c:\program files\common files\ChaosGroup
2009-08-31 22:15		–d—–	c:\program files\Chaos Group
2009-08-31 15:19		–d—–	c:\program files\BitComet
2009-08-28 12:50		–d—–	C:\VundoFix Backups
2009-08-26 22:35	2,048	a——-	c:\windows\system32\tzres.dll
2009-08-21 14:18	49,152	a——-	c:\windows\system32\E_DCINST.DLL
2009-08-21 14:18	71,168	a——-	c:\windows\system32\E_FLBBEE.DLL
2009-08-21 14:18	62,976	a——-	c:\windows\system32\E_FD4BBEE.DLL
2009-08-21 14:09		–d—–	c:\program files\epson
2009-08-21 14:09	46,080	a——-	c:\windows\system32\escimgd.dll
2009-08-21 14:09	29,696	a——-	c:\windows\system32\escwiad.dll
2009-08-21 14:09	22,016	a——-	c:\windows\system32\esccmd.dll
2009-08-17 23:55		–d—–	c:\users\dan\dwhelper
2009-08-15 22:57	107,368	a——-	c:\windows\system32\GEARAspi.dll
2009-08-15 22:57	23,400	a——-	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-15 22:56		–d—–	c:\program files\iPod
2009-08-15 22:56		–d—–	c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-15 22:56		–d—–	c:\program files\iTunes
2009-08-15 22:56		–d—–	c:\progra~2\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-15 22:56		–d—–	c:\program files\Bonjour
2009-08-15 22:55		–d—–	c:\programdata\Apple Computer
2009-08-15 22:54		–d—–	c:\programdata\Apple
2009-08-15 21:31		–d—–	c:\users\dan\appdata\roaming\Foxit
2009-08-15 21:31		–d—–	c:\program files\Foxit Software
2009-08-15 15:36		–d—–	c:\program files\Autodesk
2009-08-15 15:36	3,497,832	a——-	c:\windows\system32\d3dx9_34.dll
2009-08-15 15:36	1,124,720	a——-	c:\windows\system32\D3DCompiler_34.dll
2009-08-15 15:36	443,752	a——-	c:\windows\system32\d3dx10_34.dll
2009-08-15 15:36	3,426,072	a——-	c:\windows\system32\d3dx9_32.dll
2009-08-15 15:36	440,080	a——-	c:\windows\system32\d3dx10.dll
2009-08-15 15:36	2,414,360	a——-	c:\windows\system32\d3dx9_31.dll
2009-08-15 11:57		–d—–	c:\users\dan\appdata\roaming\Autodesk
2009-08-15 11:57		–d—–	c:\programdata\Autodesk
2009-08-15 11:57		–d—–	c:\program files\common files\Autodesk Shared
2009-08-15 11:57		–d—–	c:\program files\AutoCAD 2009
2009-08-15 11:56	3,727,720	a——-	c:\windows\system32\d3dx9_35.dll
2009-08-15 11:45		–d—–	C:\install
2009-08-14 22:29		–d—–	c:\program files\VideoLAN
2009-08-14 20:24	411,368	a——-	c:\windows\system32\deploytk.dll
2009-08-14 19:50		–d—–	c:\windows\system32\eu-ES
2009-08-14 19:50		–d—–	c:\windows\system32\ca-ES
2009-08-14 19:50		–d—–	c:\windows\system32\vi-VN
2009-08-14 19:40		–d—–	c:\windows\system32\EventProviders
2009-08-14 19:16	2,868,224	a——-	c:\windows\system32\mf.dll
2009-08-14 19:15	738,816	a——-	c:\windows\system32\inetcomm.dll
2009-08-14 19:14	218,624	a——-	c:\windows\system32\wdscore.dll
2009-08-14 19:14	130,560	a——-	c:\windows\system32\PkgMgr.exe
2009-08-14 19:14	247,808	a——-	c:\windows\system32\drvstore.dll
2009-08-14 18:56	0	a—h—	c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-08-13 21:37		–d—–	c:\users\dan\Option
2009-08-13 21:31	971,552	a——-	c:\windows\system32\drivers\tdrpm174.sys
2009-08-13 21:31	44,704	a——-	c:\windows\system32\drivers\tifsfilt.sys
2009-08-13 21:31		–d—–	c:\programdata\Acronis
2009-08-13 21:31	540,000	a——-	c:\windows\system32\drivers\timntr.sys
2009-08-13 21:31	134,272	a——-	c:\windows\system32\drivers\snman380.sys
2009-08-13 21:25		–d—–	c:\users\dan\appdata\roaming\ESET
2009-08-13 21:24		–d—–	c:\programdata\ESET
2009-08-13 21:24		–d—–	c:\program files\ESET
2009-08-13 21:05	72,704	a——-	c:\windows\system32\admparse.dll
2009-08-13 19:15	0	a——-	c:\windows\PhotoNow.INI
2009-08-13 18:02		–d—–	c:\program files\VS Revo Group
2009-08-13 04:31	920,088	a——-	c:\windows\system32\igxpun.exe
2009-08-13 04:31	319,456	a——-	c:\windows\system32\difxapi.dll
2009-08-13 04:31		–d—–	c:\windows\system32\Lang
2009-08-12 22:30	41,984	a——-	c:\windows\system32\netfxperf.dll
2009-08-12 22:29		–d—–	c:\program files\MSXML 4.0
2009-08-12 22:27	313,344	a——-	c:\windows\system32\wmpdxm.dll
2009-08-12 22:27	7,680	a——-	c:\windows\system32\spwmp.dll
2009-08-12 22:27	8,147,456	a——-	c:\windows\system32\wmploc.DLL
2009-08-12 22:27	4,096	a——-	c:\windows\system32\msdxm.ocx
2009-08-12 22:27	4,096	a——-	c:\windows\system32\dxmasf.dll
2009-08-12 22:27	43,520	a——-	c:\windows\system32\msdxm.tlb
2009-08-12 22:27	18,432	a——-	c:\windows\system32\amcompat.tlb
2009-08-12 22:26	289,792	a——-	c:\windows\system32\atmfd.dll
2009-08-12 22:26	156,672	a——-	c:\windows\system32\t2embed.dll
2009-08-12 22:26	72,704	a——-	c:\windows\system32\fontsub.dll
2009-08-12 22:26	34,304	a——-	c:\windows\system32\atmlib.dll
2009-08-12 22:26	23,552	a——-	c:\windows\system32\lpk.dll
2009-08-12 22:26	10,240	a——-	c:\windows\system32\dciman32.dll
2009-08-12 22:26	160,256	a——-	c:\windows\system32\wkssvc.dll
2009-08-12 22:26	71,680	a——-	c:\windows\system32\atl.dll
2009-08-12 22:24	2,034,688	a——-	c:\windows\system32\win32k.sys
2009-08-12 22:23	91,136	a——-	c:\windows\system32\avifil32.dll
2009-08-12 22:14	1,524,736	a——-	c:\windows\system32\wucltux.dll
2009-08-12 22:14	83,456	a——-	c:\windows\system32\wudriver.dll
2009-08-12 22:14	162,064	a——-	c:\windows\system32\wuwebv.dll
2009-08-12 22:14	31,232	a——-	c:\windows\system32\wuapp.exe
2009-08-12 22:11	49,408	a——-	c:\windows\system32\drivers\stppp.sys
2009-08-12 22:11	30,464	a——-	c:\windows\system32\drivers\st330.sys
2009-08-12 22:11	12,672	a——-	c:\windows\system32\drivers\stbus.sys
2009-08-12 22:11	16,128	a——-	c:\windows\system32\drivers\lpwdm.sys
2009-08-12 22:11		–d—–	c:\program files\Thomson
2009-08-12 22:10		–d—–	c:\temp\Thomson
2009-08-12 22:10		–d—–	C:\Temp
2009-08-12 22:02		–d—–	c:\users\dan\appdata\roaming\Malwarebytes
2009-08-12 22:02	19,096	a——-	c:\windows\system32\drivers\mbam.sys
2009-08-12 22:02	38,160	a——-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-12 22:02		–d—–	c:\programdata\Malwarebytes
2009-08-12 22:02		–d—–	c:\program files\Malwarebytes' Anti-Malware
2009-08-12 22:02		–d—–	c:\progra~2\Malwarebytes
2009-08-12 21:45	1,145	a——-	c:\windows\HOTFIX.TAG
2009-08-12 21:39	6,656	a——-	c:\windows\system32\kbd106n.dll
2009-08-12 21:32	44,544	a——-	c:\windows\system32\msxml4a.dll
2009-08-12 21:30		–d—–	c:\programdata\CyberLink
2009-08-12 21:28		–d—–	c:\program files\Acer Arcade Deluxe
2009-08-12 21:24	0	a——-	c:\windows\system32\LogConfigTemp.xml
2009-08-12 21:23	92	a——-	c:\windows\GridV.UNI
2009-08-12 21:23		–d—–	c:\program files\Acer Inc
2009-08-12 21:22	626,688	a——-	c:\windows\Image.dll
2009-08-12 21:22	262,144	a——-	c:\windows\Acer Crystal Eye webcam.EXE
2009-08-12 21:22	222,382	a——-	c:\windows\Acer Crystal Eye webcam.ico
2009-08-12 21:22	200,704	a——-	c:\windows\PLFSetI.exe
2009-08-12 21:22	4,838	a——-	c:\windows\Suyin.reg
2009-08-12 21:22	36	a——-	c:\windows\PidList.ini
2009-08-12 21:21	83	a——-	c:\windows\QtZgAcer.UNI
2009-08-12 21:21		–d—–	c:\program files\Launch Manager
2009-08-12 21:18	324,120	a——-	c:\windows\system32\drivers\iaStor.sys
2009-08-12 21:06	18,904	a——-	c:\windows\system32\StructuredQuerySchemaTrivial.bin
2009-08-12 21:05	11,967,524	a——-	c:\windows\system32\korwbrkr.lex
2009-08-12 20:57	153	a——-	c:\windows\system32\RacUREx.xml
2009-08-12 20:51		–dsh—	C:\$RECYCLE.BIN
2009-08-12 20:48		–d—–	c:\programdata\Google
2009-08-12 20:48	16,080	a——-	c:\windows\system32\results.xml
2009-08-12 20:47		–d—–	c:\users\Dan

==================== Find3M  ====================

2009-08-29 03:30	173,056	a——-	c:\windows\apppatch\AcXtrnal.dll
2009-08-29 03:30	458,752	a——-	c:\windows\apppatch\AcSpecfc.dll
2009-08-29 03:30	2,159,616	a——-	c:\windows\apppatch\AcGenral.dll
2009-08-29 03:30	542,720	a——-	c:\windows\apppatch\AcLayers.dll
2009-08-21 14:19	143,360	a——-	c:\windows\inf\infstrng.dat
2009-08-21 14:19	51,200	a——-	c:\windows\inf\infpub.dat
2009-08-21 14:19	86,016	a——-	c:\windows\inf\infstor.dat
2009-08-14 19:50	665,600	a——-	c:\windows\inf\drvindex.dat
2009-08-03 15:07	403,816	a——-	c:\windows\system32\OGACheckControl.dll
2009-08-03 15:07	322,928	a——-	c:\windows\system32\OGAAddin.dll
2009-08-03 15:07	230,768	a——-	c:\windows\system32\OGAEXEC.exe
2009-07-21 22:52	915,456	a——-	c:\windows\system32\wininet.dll
2009-07-21 22:47	109,056	a——-	c:\windows\system32\iesysprep.dll
2009-07-21 22:47	71,680	a——-	c:\windows\system32\iesetup.dll
2009-07-21 21:13	133,632	a——-	c:\windows\system32\ieUnatt.exe
2009-07-09 12:16	2,060,288	a——-	c:\windows\system32\usbaaplrc.dll
2009-07-09 12:16	39,424	a——-	c:\windows\system32\drivers\usbaapl.sys
2009-06-15 15:54	175,104	a——-	c:\windows\system32\wdigest.dll
2009-06-15 15:53	72,704	a——-	c:\windows\system32\secur32.dll
2009-06-15 15:53	270,848	a——-	c:\windows\system32\schannel.dll
2009-06-15 15:53	218,624	a——-	c:\windows\system32\msv1_0.dll
2009-06-15 15:52	1,259,008	a——-	c:\windows\system32\lsasrv.dll
2009-06-15 15:52	499,712	a——-	c:\windows\system32\kerberos.dll
2009-06-15 13:48	9,728	a——-	c:\windows\system32\lsass.exe
2008-01-21 03:57	174	a–sh—	c:\program files\desktop.ini
2006-11-02 13:39	287,440	a——-	c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 13:39	287,440	a——-	c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 13:39	30,674	a——-	c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 13:39	30,674	a——-	c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 10:20	287,440	a——-	c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20	287,440	a——-	c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20	30,674	a——-	c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20	30,674	a——-	c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 20:31:15.96 ===============
Post #10
1) HostsXpert
Please download HostsXpert
  • Unzip HostsXpert to it's own folder a convenient place such as C:\HostsXpert
  • Run HostsXpert.exe
  • Click: Make Writable? in the upper left corner.
  • Click: Restore MVPs Hosts
  • Click: Replace
  • Click: OK
  • Click: Make ReadOnly
  • Close HostsXpert.

Note: If a custom Hosts file was in place, you will have to run those programs again to reset detections.

2) GooredFix
Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2
  • Ensure all Firefox windows are closed.
  • To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
  • When prompted to run the scan, click Yes.
  • GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

3) GMER
Please download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and put it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

4) What You Will Need To Post:
  • GooredFix log
  • GMER log
  • If you are still experiencing symptoms
Post #11
Hi Raktor

Doug has suggested a solution which has now enabled me to upload files (hooray for Doug), although I'm still having problems uploading elsewhere. Please find attached my Scans plus the error message I received when using HostsXpert.
HostXpert wouldn't/cannot create file: C:\Windows\system32\DRIVERS\ETC\host.

Thanks for your continued help Raktor

Attachments:

Post #12
My mistake, please re-run HostsXpert by Right Clicking on it and clicking Run as Administrator, and follow the previous steps.

After this, are you still experiencing symptoms?
Post #13 last edited
Hi Raktor

Everything seems to be OK now.
Apparently the YouTube issue turned out to be a joke by the YouTube engineers/technicians; hilarious.
I can now upload files thanks to Doug, so that's pretty much everything except I'm still unable to run HostXperts successfully; still getting the error message.
Post #15
Hi Raktor
I think it has worked, nothing is telling me it has, but as I'm not experiencing any further problems I assume it has.
Thanks for your time and patience Raktor:thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI